Policies are simply rules that say “this is the way we are going to do things.” If you want your organization to operate in a unified and coherent manner, you must have policies in place and you must ensure that everyone in the organization knows and complies with those policies that pertain to them. This all sounds obvious and simple, but trying to implement such a system quickly becomes complex and confusing.
In the specific case of information security policy, many organizations that have been in existence for years find themselves in the unenviable position of having to formulate a body of information security policies after the fact. This is a daunting task indeed, and needs to be approached in a logical and systematic manner.
The first step in this process is to assemble an inventory of all the information assets and processes that need to be protected. All critical information, software assets, hardware devices, personnel and service providers need to be included in this inventory. A list of critical business functions that employ these assets also needs to be made. Once these tasks are accomplished, policies need to be formed and documented that address the proper use and management of each of these functions and assets. These policies need to meet the goals of the organization and any laws and regulations that apply to them.
The next step in the process is to formulate and document procedures for implementing the policies of the organization. These procedures should be sufficiently detailed to show untrained personnel to how to perform them. Finally, all of these policies and procedures need to be reviewed and adapted regularly to ensure that they remain adequate to meet the goals of the organization.
As must be readily apparent, the final result is going to be a mountain of documentation that, despite its complexity, must be readily accessible and comprehensible to all that are governed by it. This quandary is where most organizations seem to fail. Many bodies of policy and procedure I have encountered have been hard to navigate, disorganized, redundant and sometimes even self-contradictory. This causes confusion and frustration among users and thus renders the hard work put into the process largely ineffective.
To remedy this as much as possible, organizations should take that extra step and expend the manhours and resources necessary to make their written information security program usable. Policies should be organized into logical categories such as access and identity management, vendor management, security incident response, etc. This allows users to narrow the field when they are looking for specific policies. Polices should also be kept in a central repository under the responsibility of specific individuals or groups within the organization. Policies should be backed up in multiple locations and forms for business continuity purposes. Access to specific parts of the repository should be easy for authorized users, yet should be based on need to know to maintain the security of private information and processes. Policies should be very well indexed and should contain tables of content. In addition, authors of policy should always be searching for ways to remove unnecessary redundancy from policies and to make the language in them unambiguous, direct and terse. Finally, every user should receive training in all the organization policies that apply to them, how to find them and how to apply them. Performing all of these tasks will help ensure that your organizational policies are of actual use and are not just ornaments to be dangled in front of regulators and prospective customers.